<?php
/**
 * Application Passwords availability for MCP requests.
 *
 * @package HandyMCP
 */

namespace HandyMCP\Auth;

use HandyMCP\Settings;
use HandyMCP\Support\OutputGuard;

defined( 'ABSPATH' ) || exit;

/**
 * Security plugins such as Wordfence and Solid Security often turn
 * Application Passwords off site-wide. OAuth does not need them, but some
 * clients only support Basic auth. When the owner opts in, Application
 * Passwords are re-allowed for requests to this plugin's MCP endpoint only
 * (and only over HTTPS). Every other part of the site keeps the security
 * plugin's setting.
 */
final class AppPasswordPolicy {

	/**
	 * Hook filters when enabled.
	 *
	 * @param Settings $settings Settings.
	 */
	public static function register( Settings $settings ): void {
		if ( ! $settings->get( 'allow_app_passwords' ) ) {
			return;
		}
		$allow = static function ( $available ) {
			return ( is_ssl() && OutputGuard::is_mcp_request() ) ? true : $available;
		};
		add_filter( 'wp_is_application_passwords_available', $allow, PHP_INT_MAX );
		add_filter( 'wp_is_application_passwords_available_for_user', $allow, PHP_INT_MAX );
	}

	/**
	 * Are Application Passwords usable right now (outside our override)?
	 */
	public static function available(): bool {
		return function_exists( 'wp_is_application_passwords_available' ) && wp_is_application_passwords_available();
	}

	/**
	 * Name the plugin that disabled Application Passwords, if any.
	 */
	public static function blocker(): string {
		if ( class_exists( '\wfConfig' ) && method_exists( '\wfConfig', 'get' ) && \wfConfig::get( 'loginSec_disableApplicationPasswords' ) ) {
			return 'Wordfence (Login Security > Settings > Disable WordPress application passwords)';
		}
		if ( class_exists( '\ITSEC_Modules' ) && method_exists( '\ITSEC_Modules', 'get_setting' ) && \ITSEC_Modules::get_setting( 'wordpress-tweaks', 'disable_application_passwords' ) ) {
			return 'Solid Security (Security > Settings > Advanced > WordPress Tweaks)';
		}
		global $wp_filter;
		foreach ( array( 'wp_is_application_passwords_available', 'wp_is_application_passwords_available_for_user' ) as $hook ) {
			if ( empty( $wp_filter[ $hook ] ) ) {
				continue;
			}
			foreach ( $wp_filter[ $hook ]->callbacks as $callbacks ) {
				foreach ( $callbacks as $cb ) {
					$file = self::callback_file( $cb['function'] );
					if ( $file && 0 === strpos( wp_normalize_path( $file ), wp_normalize_path( WP_PLUGIN_DIR ) ) && false === strpos( $file, 'handymcp' ) ) {
						$rel  = substr( wp_normalize_path( $file ), strlen( wp_normalize_path( WP_PLUGIN_DIR ) ) + 1 );
						$slug = strtok( $rel, '/' );
						return (string) $slug;
					}
				}
			}
		}
		return '';
	}

	/**
	 * File that defines a callback.
	 *
	 * @param mixed $fn Callback.
	 */
	private static function callback_file( $fn ): string {
		try {
			if ( is_string( $fn ) && function_exists( $fn ) ) {
				return (string) ( new \ReflectionFunction( $fn ) )->getFileName();
			}
			if ( $fn instanceof \Closure ) {
				return (string) ( new \ReflectionFunction( $fn ) )->getFileName();
			}
			if ( is_array( $fn ) && 2 === count( $fn ) ) {
				return (string) ( new \ReflectionMethod( $fn[0], $fn[1] ) )->getFileName();
			}
		} catch ( \Throwable $e ) {
			return '';
		}
		return '';
	}
}